Disig preliminary incident report on missing EKU in subordinate CA under transition plan
Disig opened this bug as a preliminary incident report after receiving an email pointing to its subordinate CA Disig R2I2 Certification Service as missing EKU and therefore non-compliant with Chrome Root Program Policy. Disig said the subordinate CA is disclosed in CCADB under its legacy multi-purpose root, and that this root is part of a transition plan to replace multi-purpose roots with single-purpose hierarchies. The report states that Disig had been in contact with the Chrome Root Program since January 2026 and received a temporary exception on 2026-06-24, with a requirement that all new TLS end-user certificates be issued from the TLS-dedicated hierarchy starting 2026-09-15. Disig also said it had already disabled issuance from the legacy subordinate CA and that new TLS end-user certificates are now issued from Disig R3I1 TLS Certification Service. Chrome Root Program staff replied that the report should be resolved as INVALID, and later explained how Section 1.3.2 applies to dedicated TLS hierarchies and the phase-out of multi-purpose roots. The bug was closed RESOLVED with resolution INVALID.
- Disig reported a subordinate CA with missing EKU under its legacy multi-purpose root and said issuance had been disabled in favor of a TLS-dedicated hierarchy.
- Chrome Root Program staff said the report should be resolved as INVALID.
- The bug was closed RESOLVED INVALID.
- Disig, a.s. — Disig filed a preliminary incident report describing a subordinate CA with missing EKU, linked it to its transition plan, and said issuance from the legacy subordinate CA had been disabled.
- Google representative — Chrome Root Program staff said the report should be resolved as INVALID because Disig met the criteria for the temporary exception.
- CCADB representative — CCADB posted a final call for comments before closing the report as INVALID.
- Community commenter — A commenter asked Chrome Root Program to clarify the policy basis and scope of the exception before closing the report.
- Google representative — Chrome Root Program staff explained how Section 1.3.2 applies to dedicated TLS hierarchies and subordinate CA compliance milestones.